[PDF] VPN Configuration Guide - VPN Tracker PDF FortiOS.pdf

The first part of this guide will show you how to configure a VPN tunnel on your Fortinet VPN Fortinet FortiGate VPN Gateway 203 0 113 1 Action: Choose IPSEC (earlier FortiOS versions: ENCRYPT) from the popup list Additional options

FortiGate 100D, 140D and 140D-POE and configure FortiGate platforms with easy-to-follow instructions 10,000 IPsec VPN Throughput (512 byte packets)

[PDF] Configuring IPsec VPN with a FortiGate and a - Cisco Community

The following recipe describes how to configure a site-to-site IPsec VPN tunnel In this example, one site is behind a FortiGate and another site is behind a Cisco

[PDF] How to configure multiple FortiClients (remote VPN users) to a dial

to the User Group etc Because of these dependencies, the order for configuring VPN in the FortiGate is as follows: 1) Users 2) User Groups 3) IPSec Phase 1

[PDF] FortiGate SSL VPN User Guide - Fortinet Knowledge Base

31 jan 2012 · between SSL and IPsec • Basic Configuration explains how to configure the FortiGate unit and the web portal Along with these configuration

[PDF] Fortinet OS Data Sheet

Wide variety of configuration tools — iOS app, Web The FortiGate's unmatched performance CAPWAP data channel security: DTLS and IPsec VPN option

[PDF] FortiGate®-100D - Exclusive Networks

over time The FortiGate-100D is an ideal security solution for small and medium It combines firewall, IPSec and SSL VPN, application control, intrusion prevention, antivirus, antimalware, antispam high availability configurations Provides

VPN Configuration Guide

FortiOS

© 2010 equinux AG and equinux USA, Inc. All rights reserved. Under copyright law, this configuration guide may not be copied, in whole or in part, without the written consent of equinux AG or equinux USA, Inc. Your rights to the software are governed by the accompanying software license agreement. The equinux logo is a trademark of equinux AG and equinux USA, Inc., regis- tered in the U.S. and other countries. Other product and company names mentioned herein may be trademarks and/or registered trademarks of their respective companies. equinux shall have absolutely no liability for any direct or indirect, special or other consequential damages in connection with the use of this document or any change to the router in general, including without limitation, any lost profits, business, or data, even if equinux has been advised of the possibility of such damages. Every effort has been made to ensure that the information in this configura- tion guide is accurate. equinux is not responsible for printing or clerical er- rors.

Configuration guide revision 1

Created using Apple Pages.

www.equinux.com 2

....................................................................................Introduction 5

Using the Configuration Guide 5

Prerequisites 6

Scenario 6

Terminology 7

................................................My VPN Gateway Configuration 8 .......................................Task 1 - VPN Gateway Configuration 9

Step 1 - Retrieve Network Settings 9

Step 2 - Create a VPN User 9

Step 3 - Create a VPN User Group 10

Step 4 - Set up Phase 1 10

Step 5 - Set up Phase 2 11

Step 6 - Set up a Firewall Policy 12

........................................Task 2 - VPN Tracker Configuration 13

Step 1 - Add a Connection 13

Step 2 - Configure the VPN Connection 13

Step 3 - Test the VPN Connection 14

..........................................................................Troubleshooting 16

VPN Connection Fails to Establish 16

No Access to the Remote Network 16

Further Questions? 17

.......................................................Supporting Multiple Users 18 Option A Manually Assigning Fixed Local Addresses 18 Option B Assigning IP Addresses through Mode Config 19 3 4

Introduction

This configuration guide helps you configure VPN Tracker and your Fortinet VPN gateway to establish a VPN connection between them.

Using the Configuration Guide

Part 1 - VPN Gateway Configuration

The first part of this guide will show you how to configure a VPN tunnel on your Fortinet VPN gateway device using the web configuration interface. This guide is a supplement to the documentation included with your Fortinet VPN gateway device, it can't replace it. Please read this documentation before starting.

Part 2 - VPN Tracker Configuration

In the second part, this guide will show you how to configure VPN Tracker to easily connect to your newly created VPN tunnel. Part 3 - Troubleshooting and Supporting Multiple Users Troubleshooting advice and instructions on how to set up the VPN to support multiple users using either static IP address assignment or Mode Config can be found in the final part of this guide. If you are setting up VPN on your device for the first time, we strongly recommend you keep to the tutorial-style setup in the first and second part of this document and make modifications only after you have tested the basic setup.

Conventions Used in This Document

Links to External Websites

Sometimes you will be able to find more information on external websites. Clicking links to websites will open the website in your web browser: http://equinux.com

Links to Other Parts of this Guide

A Link will take you to another place in the configuration guide. Simply click it if you are reading this guide on your computer.

Tips and Tricks

This configuration guide contains lots of great tips. You can eas- ily spot them by looking for the light bulb icon.

Warnings

This exclamation mark warns you when there is a setting or ac- tion where you need to take particular care.

Getting Help

VPN Tracker makes VPN simple. However, computer networking and VPNs can be complex and tricky at times, so we have also built in tools and helpful fea- tures that will assist you if you ever run into problems. Check out

Trouble-

shooting for more information. 5

Prerequisites

Your VPN Gateway

This guide applies to FortiOS-based VPN gateways

Make sure you have the newest firmware version installed that is available for your device. This guide was created based on FortiOS 4.0 MR1 Patch 3 Older revisions of FortiOS (FortiOS 4.0 or FortiOS 3.0) should work fine for the basic setup as described in the first part of this document The setup using Mode Config that is described in the final part of this document requires at least FortiOS 4.0 MR1 Patch 3

Your Mac

VPN Tracker runs on Mac OS X 10.4, 10.5 and 10.6

The configuration described in this guide requires VPN Tracker 6. Make sure you have all available updates installed. The latest VPN Tracker updates can always be obtained from http://www.vpntracker.com

Scenario

In our example, we need to connect an employee's Mac to an office network. The diagram on the bottom of this page illustrates this scenario. This guide assumes that the Mac running VPN Tracker already has internet connectivity. The office's Fortinet VPN gateway device (the "VPN gateway") is also already connected to the Internet and can be accessed through a static IP address or DNS host name. In our example setup, we will be using a static IP address: 203.0.113.1. The VPN gateway has a second network interface which is connected to the internal office network (LAN). In our example, the office network is using the network 192.168.13.0/24 (which is the same as 192.168.13.0/255.255.255.0). This is the network that will be accessed from the employee's Mac through the VPN. It is called the "Remote Network" in VPN Tracker. 6

VPN Connection

Mac running

VPN Tracker

Fortinet FortiGate

VPN Gateway

203.0.113.1

Office Network

192.168.13.0 / 255.255.255.0

Terminology

A VPN connection is often called a "tunnel" (or "VPN tunnel"). Every VPN tunnel is established between two "endpoints". In our example one endpoint is VPN Tracker and the other endpoint is the VPN gateway. Each endpoint is called the other endpoint's "peer". Please note that for each endpoint, the settings on the other endpoint are considered to be "remote", while its own settings are considered to be "local". That means a "local" setting from VPN Tracker's perspective, is a "remote" set- ting from the VPN gateway's perspective, and vice versa. The sample configuration described in this guide is called a "Host to Network" configuration: a single computer, called a "Host" establishes a VPN tunnel to an entire "Network" behind the VPN gateway. 7

My VPN Gateway Configuration

Throughout this guide, there are certain pieces of information that are needed later on for configuring VPN Tracker. This informa-

tion is marked with red numbers to make it easier to reference it later. You can print out this checklist to help keep track of the

various settings of your Fortinet VPN gateway device.

IP Addresses

➊ LAN (internal) IP Address / Subnet Mask: . . . / . . .

➋ WAN IP Address: . . . (or hostname )

User Authentication (XAUTH)

➌ Username: ➍ Password:

Pre-Shared Key

➎ Pre-Shared Key: Additional Settings (only for Option B - Assigning IP Addresses through Mode Config) ➐ Address Object for the Internal (LAN) Network:

➑ Mode Config Address Range: . . . - ➒ . . .

Task 1 - VPN Gateway Configuration

We will first set up VPN on the VPN gateway. If you already have VPN in place, it's helpful to follow along this tutorial to see how settings on the device fit together with VPN Tracker.

Step 1 - Retrieve Network Settings

‣Connect to your VPN gateway through its web configuration interface We have found Firefox to work best with the FortiOS Web Con- fig interface (as of FortiOS 4.0). If you see extra options or some buttons do not work with your web browser, try using Firefox. ‣Go to System > Network ‣Write down the IP address of the internal network interface, including its subnet mask as ➊ on your

Configuration Checklist

‣Write down the IP address of the wan1 network interface (the part before the forward slash "/") as ➋ on your

Configuration Checklist. If your device

has a DNS hostname (fixed or DynDNS), write it down instead.

Step 2 - Create a VPN User

‣Go to User > Local and click Create New ‣User Name: Enter a username for the new user (here: alice). Write down the user name as ➌ ‣Password: Enter a password for this new user. Make sure to remember the password, or write it down as ➍ ‣Click OK to add the user To add more users, simply repeat this step. You might want to connect the device to an existing (LDAP or RADIUS) authentica- tion server, however, we recommend using a local user for the initial setup and testing. 9

Step 3 - Create a VPN User Group

‣Go to User > User Group and click Create New ‣Name: Enter a name for the user group (here: vpn_group) ‣Type: Choose Firewall from the popup list ‣Move the user account(s) you created in

Step 2 from the Available

Users/Groups column into the Members column on the right ‣Click OK to create the group

Step 4 - Set up Phase 1

‣Go to VPN > IPsec and click Create Phase 1 ‣Name: Enter a name for the phase 1 setup (here:vpn_phase1) ‣Remote Gateway: Choose Dialup User from the popup list ‣Local Interface: Choose wan1 from the popup list ‣Mode: Choose Aggressive mode ‣Authentication Method: Select Pre-Shared Key ‣Enter a Pre-Shared Key. Make sure to choose a good pre-shared key and remember it, or write it down as ➎ 10

Advanced Settings

‣Click Advanced... to reveal additional settings If clicking Advanced does not work, your web browser might be incompatible with the web config interface. In our experience,

Firefox works well for this task.

‣XAUTH: Choose Enable as Server When Enable as Server option is not selectable, you may have skipped creating a User Group in

Step 3. Please go back and

complete this step. ‣Click OK to save the phase 1 settings

Step 5 - Set up Phase 2

‣Click Create Phase 2 ‣Name: Enter a name for the phase 2 setup (here:vpn_phase2) ‣Phase 1: Select the phase 1 setup you created in

Step 4 from the popup

list (here:vpn_phase1) ‣Click OK 11

Step 6 - Set up a Firewall Policy

‣Go to Firewall > Policy and click Create New ‣Source Interface/Zone: Choose internal from the popup list ‣Source Address: Select the address object representing your Fortinet VPN gateway's internal network (here: LAN). If you do not yet have such an ad- dress object, create a new one (see the right side if you don't know how) ‣Destination Interface/Zone: Choose wan1 from the popup list ‣Destination Address: Select all ‣Action: Choose IPSEC (earlier FortiOS versions: ENCRYPT) from the popup list. Additional options will become available: ‣VPN Tunnel: Select the phase 1 setup you have created in

Step 4

(here: vpn_phase1) from the popup list ‣Allow outbound: The connection will always be initiated from VPN Tracker, never by the device, so you can deselect this option. ‣Click OK to add the policy Creating an address object representing the internal (LAN) network: ‣Click Create New... ‣Address Name: Enter a name for the new address object (e.g. LAN) ‣Type: Select Subnet / IP Range ‣Subnet / IP Range: Enter your VPN gateway's internal (LAN) network ad- dress and subnet mask. Make sure to use the network address, not the LAN IP address: With a 255.255.255.0 subnet mask this means setting the last part of LAN IP address ➊ to 0 (e.g. 192.168.13.1 becomes 192.168.13.0) ‣Interface: Select internal ‣Click OK to add the new address object 12

Task 2 - VPN Tracker Configuration

After finishing task 1, you should now have a completed configuration checklist containing your Fortinet VPN gate- way's settings. We will now create a matching configuration in VPN Tracker.

Step 1 - Add a Connection

Open VPN Tracker, and click the plus button in the bottom left corner of the window to add a new connection:

Enter a name for the connection that will

let you recognize it later, e.g. "Office"

Select Fortinet from the list of vendors,

then select the device profile correspond- ing to your FortiOS version

Click Create to add the new connection

Step 2 - Configure the VPN Connection

Once you have added the new connection, there are a few settings that need to be customized to match what is configured on your VPN gateway. ‣VPN Gateway: Enter the WAN IP address (or hostname) of your VPN gate- way that you wrote down as ➋ ‣Local Address: Leave empty for now. Depending on your setup, you may have to set a specific local address later. Refer to

Supporting Multiple Users

on when and how to set a specific local address. ‣Remote Networks: Enter the network address of the network that is being accessed through the VPN tunnel ➊. Separate the subnet mask with a for- ward slash ("/"). VPN Tracker will automatically turn the IP address into a network address. Double-check that the result is the same as the LAN address object configured for the policy in

Step 6

Step 3 - Test the VPN Connection

It 's time to go out!

You will not be able to test and use your VPN connection from within the in- ternal network that you want to connect to. To test your connection, you will need to connect from a different location. For example, if you are setting up a VPN connection to your office, test it from home. If you are setting up a VPN connection to your home network, test it from an Internet cafe, or go visit a friend.

Start your connection

Connect to the Internet

Make sure that your Internet connection is

working - open your Internet browser and try to connect to http://www.equinux.com

Open VPN Tracker if it's not already running

Slide the On/Off slider for the connection you

have just configured to On

When prompted for your pre-shared key:

Pre-shared key: Enter the pre-shared key that you configured on the Forti- net VPN gateway in the phase 1 settings ➎ Optional: Check the box Store in Keychain to save the password in your keychain so you are not asked for it again when connecting the next time

Click OK

When prompted for your Extended Authentication (XAUTH) credentials: User Name: Enter the name of the user you have added on the Fortinet

VPN gateway (here: alice) ➌

Password: Enter the password for the user ➍

Optional: Check the box Store in Keychain to save the password in your keychain so you are not asked for it again when connecting the next time

Click OK

14 If the slider goes back to Off after starting the connection, or after entering your pre-shared key or your XAUTH credentials, please read the

Trouble-

shooting section of this document If the slider goes to On and turns green after a while, you have successfully established a connection

Congratulations!

Troubleshooting

In most cases, your connection should work fine if you follow the instructions above. If you cannot connect, please read on.

VPN Connection Fails to Establish

On/Off Slider goes back to "Off" right away

If the slider goes back to "Off" right away, please make sure you have entered all the required information. VPN Tracker will highlight fields that are missing or obviously incorrect information.

On/Off Slider goes back to "Off" after a while

If the connection ON/OFF slider goes back to "OFF" a while after attempting to start the connection, please go to the "Log" tab to get more information about the error (or click the warning triangle to be automatically taken to the "Log" tab). VPN Tracker will display detailed suggestions for a solution:

No Access to the Remote Network

If the connection slider goes to ON and turns green, but you cannot access resources (servers, email, etc.) in the VPN, please check the following points.

Connect to an IP address (instead of a host name)

If you are not connecting to the resource by IP address (e.g. 192.168.13.42), but are using a host name (e.g. server.example.com), please try using the re- source's IP address instead. If the connection works when using the IP address, but not when using a host name, please make sure that your Mac's DNS server or the "Remote DNS" server that you have configured on your Fortinet VPN gateway is able to resolve this host name to an IP address.

Test VPN Availability again

In many networks your Mac will be behind a router that performs Network Address Translation (NAT). For a VPN connection to be established through such a router, VPN Tracker can use different methods, but not all of them may be supported by your local router or your VPN gateway. VPN Tracker automatically runs a test to detect the proper method for your particular Internet connection when you first connect using this Internet con- nection. However, test results could become outdated by changes to the local router, so it is a good idea to test again if there are problems. Select "Tools > Test VPN Availability" from the menu Click "Test Again" and wait until the test has completed

Try connecting again

Check that the IP address you are connecting to is part of the network(s) permitted in the split tunneling setup Check that the IP address you are connecting to is actually part of the remote network(s) you permitted in the firewall policy in

Step 6. Also double-check

the network mask(s) of the address object(s). 16

Further Questions?

You can find the latest news and compatibility information on our support and FAQ website: http://www.equinux.com/support

If you need to contact equinux Technical Support

If you can't resolve your issue with the information available on our website or in this guide and would like to contact Technical Support through our web- site, please be sure to include at least the following information: The manufacturer and model and firmware revision of the VPN gateway A Technical Support Report from VPN Tracker (Help > Generate Technical

Support Report)

Screenshots of what you have configured on your VPN gateway, in particu- lar all VPN-related settings A description of the problem and the troubleshooting steps you have taken 17

Supporting Multiple Users

Once your VPN expands to multiple users you must ensure that IP addresses do not conflict by assigning each user their own IP address. VPN Tracker supports manually assigning IP addresses and assignment through Mode Config.

How IP Addresses are Assigned to VPN Clients

The Local Address in VPN Tracker is the IP address that the Mac will be using in the remote network when connected though VPN. In IPsec terms: The Local Address is the local endpoint of the IPsec Security Association (SA). ‣If the Local Address field contains a fixed address this address is used. The address must be unique among all users of the VPN connection Option A - Manually Assigning Fixed Local Addresses ‣When Mode Config mode is used, the local address is assigned automati- cally by the VPN gateway Option B - Assigning IP Addresses through Mode Config ‣If the Local Address field is left empty, the Mac's actual local IP address (as shown in System Preferences > Network) is used It is not possible to use an empty Local Address if ‣the VPN has multiple users (IPs might conflict) ‣the VPN gateway is not the default gateway (router) in its network

Option A

Manually Assigning Fixed Local Addresses

Step 0 - Check Requirements

Manually assigning fixed local address works with any setup, however the administrative effort may be too high if the VPN has a large number of users or users change often.

Step 1 - Choose the Local Addresses

Choose the local addresses for your VPN clients so that ‣the local addresses are not part of the VPN's remote network (= the Fortinet

VPN gateway's LAN)

‣each client has its own, unique IP address The IP addresses may not come from the remote network because the Fortinet VPN gateway cannot act as an ARP proxy for manually assigned IP addresses. Example: The Fortinet VPN gateway 's LAN in our example is the network

192.168.13.0/24 (= 192.168.13.0/255.255.255.0). For the local addresses, choose an

arbitrary private network that is not part of this network, such as 10.0.13.0/24. For each user, pick a different IP address from that network to be used as the

Local Address in VPN Tracker:

UserIP Addressalice10.0.13.1bob10.0.13.2charlie10.0.13.3...10.0.13... 18 Step 2 - Configure the Local Address in VPN Tracker ‣Local Address: Enter the IP address that you have chosen for this user (here:

10.0.13.1 for the user alice)

If your VPN gateway is not the default gateway (router) of its network, you will have to ensure that traffic for the chosen IP addresses is routed back to the VPN gateway instead of to the usual default gateway (e.g. by adding a route on the default gateway to the VPN gateway for these IPs).

Option B

Assigning IP Addresses through Mode Config

Step 0 - Check Requirements

Assigning IP addresses through Mode Config requires FortiOS 4.0 MR 1 Patch 3 or higher. It is necessary to switch the VPN setup to an interface mode (route-based) VPN and to use the command line interface (CLI) for some parts of the setup procedure. Mode Config is only available with IPsec Interface Mode. We will therefore set up the connection to use interface mode. FortiOS supports both Mode Config, as well as Cisco's EasyVPN extensions. Since VPN Tracker also supports EasyVPN, we will be using EasyVPN, although a setup using only Mode Config without Cisco's extensions would also be possible.

Steps 1 to 3 - Follow Steps 1 to 3 of Task 1

The first three steps of the setup are the same as for the policy-based VPN in

Task 1.

‣If you have already followed

Steps 1 to 3 of Task 1, simply remove the con-

figuration created inquotesdbs_dbs9.pdfusesText_15

[PDF] [PDF] VPN Configuration Guide - VPN Tracker